Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'Cucumaria' = '%TEMP%\BEMANDENDE\Inactivations1.vbs'
- inactivations1.exe
- %TEMP%\bemandende\inactivations1.exe
- %TEMP%\bemandende\inactivations1.vbs
- http://ba###aco.com/waz30_OIwzej222.bin
- DNS ASK ba###aco.com
- '%TEMP%\bemandende\inactivations1.exe'